Pair-Level Candidate Generation for Threat Early Warning over Temporal Security Knowledge Graphs

Threat early warning must flag suspicious actor interactions from open-source intelligence ahead of time. We frame it as temporal link prediction over a temporal security knowledge graph, whose output is an early-warning candidate for human triage. TGN-Sec adapts the temporal graph network to the security setting via a relation-aware message function (Modification A) and temporal decay attention (Modification B), mapping scores to candidates through relative ranking; online maintenance loops via memory updates, elastic weight consolidation (EWC) fine-tuning, and a Kolmogorov–Smirnov (KS) test for drift retraining. Built from GDELT 2.0, the evaluation graph spans 92 days, 167 entities, 14,223 edges, and 5 CAMEO-derived relation types; under an aligned protocol we ablate the two modifications, compare against five baselines, and run a comparability check exposing 8 defects. On pair-level early-warning candidate generation TGN-Sec reaches F1 of 0.1074 ± 0.0134 against the top baseline TransE at 0.0402, about 2.2 to 3.0 times, with pair-level recall leading 2.87 to 4.65 times and the lowest repeated-alert rate (29.99%), scoped to human triage rather than automatic alerting. The reverse also holds: item-level precision of 0.0762 ± 0.0090 lags the baselines (0.2427 to 0.2813) by 3.2 to 3.7 times, the two modifications show no significant independent contribution, and recall on pairs unseen in training is 0.000 across three seeds. This paper favors honest assessment of a constructed system and treats protocol alignment as a prerequisite before any continuous-time metric is reported.